Scan Operating Systems with cnspec

cnspec scans the operating system on any host against security and compliance benchmarks: kernel hardening, SSH configuration, file permissions, user accounts, audit logging, and dozens of other controls. It scans the machine it runs on, a remote host over SSH or WinRM, or a container, without leaving an agent behind.

New to cnspec? Read the Quickstart to install cnspec and run your first scan.

Choose your operating system

How OS scanning works

Point cnspec at a target and it detects the platform, selects the matching security policy, and reports which checks pass and fail with remediation guidance:

cnspec scan local            # the machine cnspec runs on
cnspec scan ssh user@HOST    # a remote Linux or Unix host
cnspec scan docker CONTAINER # a running container

To read scan output in detail and learn about every output format, see Report Results.

Go further with Mondoo Platform

To continuously scan your fleet, track posture over time, and manage remediation, register cnspec with Mondoo Platform. You can also roll cnspec out with Ansible, Chef, or cloud-init.